Must Delaware DHSS create a new COVID case-count report by school district when historical web data has been destroyed by a vendor?

Plain-English summary

Molli Carter asked DHSS for weekly COVID case counts by school district from August 15, 2020 through August 25, 2021, broken down by staff and students. The data had previously been on a public-facing dashboard but had been removed. DHSS denied the request, explaining that the dashboard ("My Healthy Community") is operated by an outside vendor, the vendor had destroyed the previous reports, and DHSS would need to "comb through historical case data" to compile new reports. DHSS pointed Carter to a raw-data request channel through the Human Subjects Review Board, which evaluates such requests for privacy and security.

Carter petitioned, arguing that hard-copy or summary forms should be available, that the precedent DHSS cited involved someone who already had hard copies and wanted them in electronic form, and that DHSS should not be able to deny her request while pointing her elsewhere for the same data.

The AG sided with DHSS. Two findings:

1. The reports no longer exist. The vendor destroyed the historical reports. The current dashboard does not include the historical periods Carter wanted. DHSS therefore had no existing record matching the request.

2. No-create rule applies. Delaware FOIA does not require a public body to compile a new record from raw data, write a program to extract a particular slice, or "comb through" historical case data to produce an aggregated report that does not currently exist. AG Op. 04-IB14 and 19-IB32 confirm this rule.

The AG noted that the public body's representations through counsel can satisfy the burden of proof in this kind of "we don't have it" situation, even without an affidavit (Judicial Watch v. Del. DOJ, 2021). The AG also encouraged DHSS to follow through on its plan to put historical data back on the website and noted Carter could submit a raw-data request to the Human Subjects Review Board.

What this means for you

If you are a Delaware journalist or researcher seeking historical health data

The no-create rule is a real constraint. Strategies to work around it:

• Ask for raw data, not aggregates. Raw data already exists in agency databases. Ask for it (typically through the Human Subjects Review Board for health data) and aggregate it yourself.
• Ask early. Records that exist when you request them may not exist later. Vendors destroy reports per their contracts. DHSS does not have to recreate.
• Look for federal mirror data. CDC and HHS often hold mirrored versions of state COVID data that survive vendor data-destruction events.

If you handle FOIA at a Delaware state agency that uses third-party vendors

Vendor-held data is a structural problem for FOIA transparency. Two practical issues:

• You cannot rely on a vendor's retention schedule for FOIA defense. If the vendor destroys data, that fact may protect you from a no-create demand, but it also leaves you without the ability to fulfill future requests. Consider building retention requirements into vendor contracts.
• Distinguish what the vendor holds from what you hold. Vendor-held data is often within the agency's "control" for FOIA purposes if the vendor is acting on the agency's behalf. The destruction defense in 21-IB25 worked because the data was already gone, not because the vendor's holding shielded it.

If you are a Delaware parent or school advocate

For ongoing data, the public dashboard is the primary source. For historical data:

• The Human Subjects Review Board path is open if you have a research need.
• Contact the school district directly. Many districts kept their own COVID logs.
• The Delaware General Assembly's Joint Finance Committee testimony often summarizes historical data as a matter of legislative oversight.

Common questions

Q: Why did DHSS not just produce the report from the old dashboard?
A: Because the vendor destroyed it. DHSS confirmed with the vendor that the historical reports no longer exist as discrete records.

Q: Doesn't FOIA require an agency to provide records in any usable format?
A: It requires existing records to be produced in their existing format (or in a reasonably accessible format). It does not require the agency to compile a new aggregated report from raw data.

Q: What is the "Human Subjects Review Board"?
A: A review board within DPH that evaluates requests for raw health data to ensure subject privacy and data security. Researchers and journalists with a defined data need can apply.

Q: Why did counsel's unsworn statements work here when 22-IB12 (Pusey) and 22-IB39 (Edelman) said unsworn statements were insufficient?
A: The sworn affidavit standard from Judicial Watch v. University of Delaware was issued in December 2021, two months after this opinion. This October 2021 opinion still cited the older line that counsel's representations could meet the burden. Today, the answer would likely look different: DHSS would need a sworn affidavit explaining what was searched, that the vendor destroyed the records, and why no responsive record exists.

Q: Can DHSS waive the privacy review and just give me raw data?
A: Not at the journalist's level. The Human Subjects Review Board exists to ensure de-identification and data-security commitments. A user agreement with the requester is typical.

Q: Why didn't DHSS run the 2018-style summary report it had previously produced?
A: DHSS told the AG that the way it categorized data had changed; the old binary categories did not capture the granularity it now collects. Re-running the old format would itself be creating a new record.

Background and statutory framework

Pre-Judicial Watch standard. Before December 2021, the AG's office accepted public body counsel's representations as adequate to meet the § 10005(c) burden in the right circumstances, citing Judicial Watch v. Del. DOJ, 2021 WL 22550 (Del. Super. Jan. 4, 2021). The Delaware Supreme Court's later Judicial Watch v. University of Delaware decision tightened that standard to require sworn factual support.

No-create rule. AG Op. 04-IB14 (June 28, 2004) is the seminal Delaware authority: "FOIA does not require an agency to make a summary or compilation of information in public records, or to produce computerized data in a special format requested by the citizen." Op. 19-IB32 reaffirmed the rule in a DHSS context.

Human Subjects Review Board. DPH's mechanism for evaluating raw-data requests for research use, with attention to privacy and security. Distinct from the FOIA process; it is the substantive backstop for getting underlying data when the no-create rule blocks aggregated reports.

Citations and references

Statutes:
- 29 Del. C. § 10005(c) (burden of proof)

Cases:
- Judicial Watch, Inc. v. Del. Dep't of Justice, 2021 WL 22550 (Del. Super. Jan. 4, 2021)

Prior AG opinions:
- Del. Op. Att'y Gen. 04-IB14 (June 28, 2004)
- Del. Op. Att'y Gen. 19-IB32 (June 24, 2019)

Source

• Landing page: https://attorneygeneral.delaware.gov/2021/10/20/21-ib25-10-20-2021-foia-opinion-letter-to-molli-carter-re-foia-complaint-concerning-the-delaware-department-of-health-and-social-services/
• Original PDF: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2021/10/Attorney-General-Opinion-No-21-IB25.pdf

Original opinion text

DEPARTMENT OF JUSTICE

KATHLEEN JENNINGS
ATTORNEY GENERAL

NEW CASTLE COUNTY
820 NORTH FRENCH STREET
WILMINGTON, DELAWARE 19801

CIVIL DIVISION (302) 577-8400
FAX: (302) 577-6630
CRIMINAL DIVISION (302) 577-8500
FAX: (302) 577-2496
FRAUD DIVISION (302) 577-8600
FAX: (302) 577-6499

OFFICE OF THE ATTORNEY GENERAL OF THE STATE OF DELAWARE
Attorney General Opinion No. 21-IB25
October 20, 2021
VIA EMAIL
Molli Carter
[email protected]

RE:

FOIA Petition Regarding the Delaware Department of Health and Social Services

Dear Ms. Carter:
We write in response to your correspondence alleging that the Delaware Department of
Health and Social Services ("DHSS") violated the Delaware Freedom of Information Act, 29 Del.
C. §§ 10001-10007 ("FOIA") with regard to your records request. We treat your correspondence
as a Petition for a determination pursuant to 29 Del. C. § 10005(e) regarding whether a violation
of FOIA has occurred or is about to occur. For the reasons set forth below, it is our determination
that DHSS has not violated FOIA as alleged.

BACKGROUND
On August 25, 2021, DHSS received your request for the following records:
I would like to know the COVID case count by district for each week starting 8/15/20 –
8/25/21 (this data has been removed from the public website and no summer data was
presented despite robust summer schools being in place). I would like to know the number
of staff and number of students each week. 1
DHSS denied your request on September 3, 2021, stating that "DHSS is unable to produce the
records you requested under FOIA as the information is not maintained by DHSS in a readily
accessible format that can be accessed without writing a program or creating a new document." 2
1

Petition.

2

Id.

Citing to Attorney General Opinion precedent, DHSS states that "FOIA does not require an agency
to create a document or program that does not already exist." 3 However, as this request is for
health data, DHSS also pointed out that you may submit a data request to the Division of Public
Health ("DPH") for the historical data and included a reference to a website. This Petition
followed.
The Petition asserts this denial is improper. You contend that the cited opinion "actually
referred to a situation where the person submitting the FOIA had received the information in hard
copy and [also] wanted the information in electronic form," but unlike this opinion in which hard
copies were provided, you were denied any records. 4 In particular, you note that the opinion states
that FOIA does not make any distinction between records maintained in manual and electronic
storage systems and that the chosen type of storage system does not diminish a public body's FOIA
obligations. You state you prefer to receive the records in "hard form" but would take them in any
format. You argue that you have not located any information suggesting that "FOIA precludes an
agency from creating a document – they might charge [you] for it, but they still create it." 5 In
addition, you question how DHSS can deny your request for these records, if they referred you
elsewhere for the same records. In other words, you want to know why DHSS did not obtain the
records you requested from this source in response to your FOIA request.
DHSS, through its legal counsel, replied to the Petition on September 24, 2021
("Response"). DHSS notes are you are correct that the COVID case counts for in-person learning
was previously available online broken down by week and district. DHSS explains that this
information is now back online, but the data you are seeking is historical data that is no longer
populating the DHSS website. Instead, DHSS notes that DPH contracts with an outside vendor
who operates the coronavirus website known as "My Healthy Community." DHSS asserts it
checked with the vendor and confirmed that the vendor has destroyed any previous reports which
would have been responsive to your request. DHSS states that the vendor uses the data from
DPH's system which tracks every COVID test and case in Delaware; this vendor, not DPH, creates
the reports that appear in this website. In order to fulfill your request for summer school data,
DHSS asserts that "the State would be required to dig through months of COVID cases to break
out student and teacher cases, create a new report, and submit that to [you]." 6 DHSS explains that
summer school data was never on the website; with such low numbers of individuals in summer
school, the data could reasonably lead to identification. As many citizens have requested historical
data, DPH plans to work with its vendor to add historical data back to the website. In addition,
DHSS notes that you are welcome to submit a request for the raw data; those requests are evaluated
by the Human Subjects Review Board in order to ensure that the data, and the subjects of the data,
are private and secure. Citing precedent, DHSS claims that it has no obligation under FOIA to
create a new record, and fulfilling your request for school data would require DPH or its vendor
3

Id.

4

Id.

5

Id.

6

Response.
2

to "create a new record from existing data sets" and fulfilling the request for summer school data
would require DPH "to comb through historical case data, analyze those cases to provide only deidentified data and then create a new record." 7

DISCUSSION
Under FOIA, a public body carries the burden of proof to justify denial of a request for
records. 8 The representations of the public body's legal counsel may satisfy this burden. 9 FOIA
requires a public body to provide access to its existing public records, but it does not require a
public body to create a new record in order to fulfill a records request. 10
Your request makes a specific request for COVID case count by district for each week for
a timeframe encompassing the 2020-21 school year and 2021 summer school, including the
number of staff and number of students each week. Although information about the current school
year is now available online, DHSS's counsel represents that the requested reports for the 202021 school year reports no longer exist and to recreate them would require DHSS to create a new
record from public health case data and that creating new reports about summer school would
require DHSS to "comb through historical case data" to break out student and teacher cases, deidentify the data, and create a new record. Based on these representations, we find no violation of
FOIA. 11 Your request did not seek the raw data, but we note that DHSS has offered you the
opportunity to submit a request for raw data through its Human Subjects Review Board.
Furthermore, in the interest of public transparency, we encourage DHSS to follow its plan to make
historical data available on its website in the future.

7

Id.

8

29 Del. C. § 10005(c).

9

Judicial Watch, Inc. v. Del. Dep't of Justice, 2021 WL 22550, at *5 (Del. Super. Jan. 4,
2021) (accepting the representations of the public body's attorney to meet the public body's burden
of proof under FOIA).
10

See, e.g., Del. Op. Att'y Gen. 04-IB14, 2004 WL 1547683, at *2 (Jun. 28, 2004) ("FOIA
does not require an agency to make a summary or compilation of information in public records, or
to produce computerized data in a special format requested by the citizen. It is not 'necessary for
a computer operator to create new records through a computer run, i.e., search of the online
database, accomplished by entering the [requesting party's] search criteria.' Nor does FOIA
obligate an agency to 'develop a program to accomplish this task for the purpose of complying
with [the FOIA] request.'") (internal citations omitted).
11

See id.; see also Del. Op. Att'y Gen. 19-IB32, 2019 WL 4538318, at *3 (Jun. 24, 2019)
("However, DHSS has not indicated that any such report exists in the fashion you contemplate and
FOIA does not require creation of a document.").
3

CONCLUSION
As set forth above, it is our determination that DHSS has not violated FOIA as alleged in
the Petition.
Very truly yours,
/s/ Alexander S. Mackler

Alexander S. Mackler
Chief Deputy Attorney General

cc:

Joanna S. Suder, Deputy Attorney General
Dorey L. Cole, Deputy Attorney General

4